rscrypto/.github/workflows/rsa.yaml at main · loadingalias/rscrypto · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
name: RSA

on:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  RUST_BACKTRACE: 1
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  RSCRYPTO_TEST_MODE: rsa

permissions:
  contents: read

jobs:
  rsa-miri:
    name: RSA Miri (Linux x64)
    uses: ./.github/workflows/_rust-job.yaml
    with:
      runner: runs-on=${{ github.run_id }}/runner=linux-x64-ci
      timeout_minutes: 360
      cache_key: rsa-miri-linux-x64
      tools_mode: minimal
      toolchain_components: "miri, rust-src"
      enable_magic_cache: true
      enable_rust_cache: true
      run_script: |
        set -euo pipefail
        mkdir -p ci-evidence
        {
          uname -a
          lscpu
          just test-miri --rsa
        } 2>&1 | tee ci-evidence/rsa-miri-linux-x64.log
      artifact_name: rsa-miri-linux-x64
      artifact_path: ci-evidence/rsa-miri-linux-x64.log
      artifact_always: true

  rsa-leakage:
    name: RSA Leakage (${{ matrix.target.name }})
    strategy:
      fail-fast: false
      matrix:
        target:
          - name: linux-x64
            runner: runs-on=${{ github.run_id }}/runner=linux-x64-ci
          - name: linux-arm64
            runner: runs-on=${{ github.run_id }}/runner=linux-arm64-ci
    uses: ./.github/workflows/_rust-job.yaml
    with:
      runner: ${{ matrix.target.runner }}
      timeout_minutes: 180
      cache_key: rsa-leakage-${{ matrix.target.name }}
      tools_mode: minimal
      enable_magic_cache: true
      enable_rust_cache: true
      run_script: |
        set -euo pipefail
        mkdir -p ci-evidence
        {
          uname -a
          lscpu
          RSCRYPTO_RSA_LEAKAGE_SAMPLES="${RSCRYPTO_RSA_LEAKAGE_SAMPLES:-4000}" \
          RSCRYPTO_RSA_LEAKAGE_T_THRESHOLD="${RSCRYPTO_RSA_LEAKAGE_T_THRESHOLD:-8.0}" \
            just test-rsa-leakage
        } 2>&1 | tee "ci-evidence/rsa-leakage-${{ matrix.target.name }}.log"
      artifact_name: rsa-leakage-${{ matrix.target.name }}
      artifact_path: ci-evidence/rsa-leakage-${{ matrix.target.name }}.log
      artifact_always: true

  complete:
    name: Complete (RSA)
    needs: [rsa-miri, rsa-leakage]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Assert RSA lanes passed
        run: |
          failed=0
          for lane in \
            "rsa-miri=${{ needs.rsa-miri.result }}" \
            "rsa-leakage=${{ needs.rsa-leakage.result }}"
          do
            name="${lane%%=*}"
            result="${lane#*=}"
            if [ "$result" != "success" ]; then
              echo "FAIL: $name ($result)"
              failed=1
            else
              echo "  OK: $name"
            fi
          done
          if [ "$failed" -eq 1 ]; then
            exit 1
          fi